5 ms·
> The thing I hate about password managers is I am afraid I would stop knowing my passwords. That is a feature. The handful of passwords I know are mostly long
by gregmac 7y ago
> The thing I hate about password managers is I am afraid I would stop knowing my passwords.
That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range.
In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site.
If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters).
I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.
- snypox 7y agoHow do you have unique emails per site?
- ashton314 7y agoNot OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.
- stinos 7y agoSome overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal-email@whatever.domain.org`. Pretty convenient for filtering.
- croon 7y agoI have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.
- diroussel 7y agoI've been doing that for over a decade. It's great. If I get a phishing email about my iCloud account, but it's sent to my yahoo@mydomain.com then it's obviously a phishing attempt, not need to check for other markers. You can also see who has sold/leaked your email address for marketing purposes.
- gregmac 7y agoI use a catch-all subdomain (like *@something.mydomain.com) that simply forwards to my main account. I then sign up on sites using something like news.ycombinator.com@something.mydomain.com or hackernews@something.mydomain.com. I've been doing it since ~2001. The only downside is long e-mail addresses, but my password manager deals with that for the most part. Subdomain is important, otherwise you get dictionary-style spam email attacks (as well as everything coming to whoever owned the domain before you, if anyone). I've never noticed that style of attack to the sub-domain. I've also got very little actual spam to this. A handful of e-mail addresses were obviously leaked/sold but by far the bulk of the spam I get comes to my primary e-mail address which I never use to sign up for anything.